Claude Skills by peterbamuhigire

Detect project type, recommend documentation methodology (Waterfall/Agile/Hybrid), and generate documentation roadmap. Use this as the FIRST skill when starting documentation for any project.

Use when the task matches skill: new project scaffold and this skill's local workflow.

Use when proving that every irreversible agent action in the audit window had a documented, signed approval — completeness check (gap-detection job), approval-evidence cross-link to the hash-chained action audit log, and evidence pack for SOC 2 Processing Integrity (PI1.1). Pairs with `ai-agent-action-approval-and-hitl` (mechanism) and `ai-agent-audit-log-integrity` (storage).

Use when pricing, billing, refunding, recognizing revenue, or packaging commercial terms for agentic AI services and outcomes.

Use when mapping AI agent operations to SOC 2, ISO 27001, HIPAA, audit logs, control testing, attestations, and compliance evidence.

Use when capturing kill-switch, red-team, and eval-drift drills as audit-ready compliance evidence — minimum-cadence enforcement, pass/fail recording, and cross-link to the incident drill skill. Turns drills from operational exercises into SOC 2 / ISO 27001 / HIPAA evidence rows with signed packs.

Use when defining agent budgets, step limits, reversibility, blast-radius controls, kill switches, and governance policy for agentic AI systems.

Use when proving agent-memory erasure was complete and verifiable for GDPR / CCPA / POPIA / KE DPA requests — the 9-step cascade verification job emits a signed-off evidence pack. Pairs with `ai-agent-memory` (three-tier memory + erasure cascade) and `saas-tenant-data-portability-and-erasure` (tenant-level erasure pipeline).

Use when designing systems where multiple agents collaborate on one task — supervisor/worker, debate, plan-execute, peer handoff. Covers handoff message contracts, shared scratchpad, conflict resolution, deadlock detection, and the cost/SLA discipline that keeps multi-agent setups from spiralling.

Use when measuring, evaluating, replaying, evidencing, or tracking success for AI agent tasks, steps, traces, and outcomes.

Use when designing the runtime that hosts agentic LLM features in a multi-tenant SaaS — the agent loop as a control-plane service, formal state machine (PERCEIVE → PLAN → ACT → OBSERVE), retries, idempotency, max-step caps, deterministic resumability, and the "agent vs workflow vs cron" decision. Distinct from `ai-agents-tools` (agent fundamentals) and `ai-on-saas-architecture` (overall AI architecture).

Use when hardening agentic features against agent-specific attack surfaces — indirect prompt injection (via tool output, retrieved chunk, web page), action escalation (chain a low-privilege tool's output into a high-privilege tool's args), tenant data exfil via tool chain, recursive self-modification, and the CI red-team suite that catches regressions. Distinct from `ai-prompt-injection-and-tenant-safety` (direct user-input injection) by focusing on the agent's *tool-and-data perimeter*.

Use when defining agent SLAs, customer commitments, SLA dashboards, credits, support promises, and service evidence for agentic AI products.

Use when designing agent tool catalogs, tool schemas, action gating, human approval, and human-in-the-loop control for agentic AI systems.

Use when designing AI analytics, dashboards, SaaS AI metrics, NLP analytics, predictive analytics, or executive AI insight workflows. Orchestrates the former granular AI analytics skills as references.

Use when designing or building AI-powered application systems — choosing

Use when modeling, metering, attributing, billing, or controlling AI usage costs across tenants, plans, features, providers, and agent workloads.

Use when discovering, designing, prioritizing, or auditing AI-powered products

Use when designing how AI features are unlocked by plan tier — which model tier (flagship vs distilled), context-length limits, generations/day, tools available to the agent, KB ingestion size, gated AI features (per-feature toggle by plan). Covers entitlement schema, gateway enforcement, upgrade UX, and the contract with `saas-entitlements-and-plan-gating` for the catalogue.

Use when setting up quality assurance for AI features — defining evaluation

Use when rolling out AI features safely in a multi-tenant SaaS — feature flags scoped per tenant/user, percentage rollouts gated by eval and SLO budget, canary cohorts, A/B testing of prompts/models, automatic rollback on quality regression, tenant-level opt-out and consent, and shadow-mode for risky changes.

Design a single AI-powered feature end-to-end — model selection, prompt

Use when preventing, detecting, triaging, communicating, recovering from, or reviewing AI incidents, AI errors, RCA, and postmortems.

Integrate LLMs into any application — OpenAI, Anthropic Codex, DeepSeek,

Use when designing or building the LLM gateway — the single outbound surface from the SaaS to all LLM providers. Covers provider abstraction, model selection per tenant tier, fallback chains, retries, per-tenant rate limiting and token caps, request signing, audit logging, regional routing for data residency, cost capture at write time, kill-switch enforcement, and the SDK/HTTP contract feature teams consume.

Use when building the observability stack for AI features in a multi-tenant SaaS — prompt/response tracing, semantic logging, replay tooling, "show me why this answer", per-stage latency/cost breakdown, ticket→trace tie-back, and dashboards that answer the operational questions (which tenant, which feature, which prompt version, which model).

Systematically discover and rank AI use cases for any software project

Use when writing, refining, or structuring prompts for AI-powered app

Use when building features that answer questions from private data, documents,

Security checklist for AI-powered application features — prompt injection

Use when designing or building an AI-enhanced web app (Next.js + Vercel AI SDK, MCP tools, multi-provider chat/RAG) — produces the module gate, token-ledger + budget schema, provider abstraction, and output guardrails. Specialises the integration patterns in `ai-architecture-patterns` for a web-app runtime; hand off metering depth to `ai-metering-billing` and prompt/threat depth to `ai-security` / `llm-security`.

Build production AI agents with the OpenAI Agents SDK (Python) — 6 core

Use when designing or building HTTP APIs — spec-first OpenAPI workflow, REST conventions, versioning, auth model, rate limiting, idempotency keys, error envelope, and observability notes. Produces the OpenAPI contract plus error/auth/idempotency/observability artifacts that frontend, mobile, security, and reliability skills consume. For endpoint-level security review load `vibe-security-skill`; for GraphQL-specific hardening load `graphql-patterns` reference `references/graphql-security.md`.

Use when designing or reviewing multi-service, message-driven, or eventually

Use when designing, building, or operating GraphQL APIs with Apollo Server +

Use when designing, reviewing, or refactoring microservice boundaries, communication, service ownership, deployment independence, resilience, and distributed data flows. Load absorbed microservices fundamentals, models, communication, and resilience references as needed.

Use when defining or reviewing software architecture for web apps, mobile

Use when authoring or normalising a specialist skill, or preparing to ship a feature or release — defines the seven evidence categories every specialist skill must declare against and provides the canonical Release Evidence Bundle template. The contract spine that turns scattered validation skills into a coherent ship-readiness check.

Use when designing or reviewing relational or document-backed data architecture

'Database reliability engineering: SLI/SLO design and error-budget policy

Use when designing, implementing, or reviewing MySQL application schemas, SQL, indexes, constraints, stored routines, and production query patterns. Load absorbed MySQL best-practice, data-modeling, and advanced-SQL reference files as needed.

Use when administering, tuning, backing up, restoring, monitoring, or troubleshooting MySQL production systems. Load absorbed MySQL administration and query-performance reference files for operational runbooks, indexes, replication, and incident response.

Use when designing, implementing, or reviewing PostgreSQL application data models, SQL, indexes, constraints, extensions, server-side routines, and production query patterns. Load the absorbed PostgreSQL reference files for fundamentals, advanced SQL, schema patterns, and server programming.

Use when administering, tuning, backing up, restoring, monitoring, or troubleshooting PostgreSQL production systems. Load the absorbed PostgreSQL administration and performance reference files for operational runbooks, query tuning, vacuum, replication, and incident response.

Use when designing or implementing a CI/CD pipeline — stage gates, GitHub Actions production patterns (matrix, reusable workflows, environments), OIDC federation to AWS/GCP/Vault, dependency and Docker-layer caching, fan-out/fan-in orchestration, blue/green and canary deployment, pipeline observability (DORA metrics, queue time), and choosing between GitHub Actions and GitLab CI.

Use when designing cloud deployments, Dockerising applications, laying out AWS or GCP environments, choosing a deployment pattern, or moving a workload from a single VM to a resilient multi-AZ topology.

Use when designing or reviewing deployment pipelines, rollout strategies,

Docker and Docker Compose standards for PHP, Python, JavaScript, and API services. Use when containerizing development environments, production images, CI builds, PHP-FPM/Nginx stacks, Python sidecars, Node/JS services, or multi-service SaaS deployments.

Use when provisioning or changing cloud infrastructure with Terraform or Ansible — modules, remote state with S3 native locking, workspaces vs directory-per-env, common AWS patterns, idempotent Ansible roles for Debian/Ubuntu, GitOps with ArgoCD/Flux, drift detection, and Vault secret injection.

Use when running Kubernetes as a platform team — bootstrapping self-managed clusters on Debian/Ubuntu, designing multi-tenant RBAC, enforcing Pod Security and resource quotas, and operating cluster lifecycle (upgrades, certs, etcd, ingress, cert-manager, metrics-server). Self-managed first, cloud-managed second.